| name | release-clawpatch |
| description | clawpatch release: version/changelog, CI, npm publish, GitHub release, verify. |
Clawpatch Release
Scope
Release ~/Projects/clawpatch as the public npm package clawpatch.
Use $npm and $one-password rules for registry auth. Keep all op and npm secret work inside one persistent tmux session and temp npmrc. Never print tokens, passwords, or OTPs.
Workflow
-
Start clean on main.
cd ~/Projects/clawpatchgit status --short --branchgit pull --ff-only- Confirm target version is not already tagged or released:
git tag --list "vX.Y.Z" and gh release view vX.Y.Z --repo openclaw/clawpatch.
- Confirm npm state:
npm view clawpatch version dist-tags time --json.
-
Prep release files.
- Set
package.json version to target.
- Change top changelog section from
Unreleased to X.Y.Z - YYYY-MM-DD.
- Ensure release notes are the changelog body for that version and include all user-facing changes.
- Run
pnpm install --lockfile-only; commit lockfile only if it actually changes.
-
Prove locally before publishing.
- Run
pnpm typecheck && pnpm lint && pnpm format:check && pnpm test && pnpm build && pnpm pack:smoke.
- Fix failures before continuing.
-
Commit and push release prep.
- Commit with
committer "chore(release): X.Y.Z" CHANGELOG.md package.json [pnpm-lock.yaml].
git push origin main.- Watch CI/CodeQL for the release commit:
gh run list --repo openclaw/clawpatch --branch main --commit <sha> --json databaseId,workflowName,status,conclusion,url,headShagh run view <run_id> --repo openclaw/clawpatch --json status,conclusion,url,jobs
- Do not publish until release-commit CI and CodeQL are green.
-
Publish npm.
- Use a temp npmrc, never the default user npmrc.
- First try
npm whoami; if unauthenticated, use npm web login in the tmux session:
NPM_CONFIG_USERCONFIG="$tmp_npmrc" npm login --auth-type=web --registry=https://registry.npmjs.org/- Open/approve browser login if prompted.
- For publish, fetch a fresh OTP from the
npmjs 1Password item inside the same tmux session.
- Publish with
NPM_CONFIG_USERCONFIG="$tmp_npmrc" npm publish --access public --otp "$NPM_OTP".
- Clean temp npmrc/work dirs after publish.
- If publish says the version already exists, verify npm metadata and continue only if it matches the release commit/package contents.
-
Verify npm before GitHub release.
npm view clawpatch@X.Y.Z version dist-tags dist.tarball dist.integrity time --json- Required: version is
X.Y.Z, latest points to X.Y.Z, tarball URL exists, integrity exists, publish time exists.
-
Tag and create GitHub release.
- Build release notes from changelog plus npm/proof:
- npm version page
- registry tarball
- integrity string
- CI and CodeQL run URLs
- local proof command
- Use temp files for public GitHub bodies.
git tag -a vX.Y.Z <release_sha> -m "vX.Y.Z"git push origin vX.Y.Zgh release create vX.Y.Z --repo openclaw/clawpatch --title "vX.Y.Z" --notes-file "$notes"
-
Release verify.
npm view clawpatch@X.Y.Z version dist-tags.latest dist.tarball dist.integrity time.X.Y.Z --jsongh release view vX.Y.Z --repo openclaw/clawpatch --json tagName,url,body,isDraft,isPrerelease- Confirm release body contains changelog notes, npm version link, tarball, integrity, and CI/proof.
- Confirm tag points at the release commit:
git rev-list -n1 vX.Y.Z.
-
Post-release closeout.
- Add next patch section at top of
CHANGELOG.md: ## X.Y.(Z+1) - Unreleased.
- Commit with
committer "docs(changelog): open X.Y.(Z+1)" CHANGELOG.md.
- Push
main.
- Watch closeout CI until green.
- Final:
git checkout main && git pull --ff-only && git status --short --branch.
Notes
- Do not create the GitHub release before npm publish is verified; the release body must include npm proof.
- If npm auth scripts fail, keep the same tmux session. Do not start a second secret session unless the first is unusable.
- Avoid broad secret inspection. Query exact
npmjs fields only.
- Public
gh comments/releases should use temp --body-file / --notes-file, not inline quoted bodies.
